This sucks. Matter is a closed ecosystem, enforced using a public key infrastructure (PKI) and device attestation certificates. Thread seems to require paying royalties if you want to ship devices. It’s disappointing that IKEA claims that this move is towards a more open ecosystem. On top of that, the switch breaks compatibility with existing hardware (except for the Touchlink functionality). If you have a bunch of Z…
This isn't entirely true, isn't it? I mean, the whole internet runs on a PKI and we need such a mechanism to ensure secure communication across devices in the network. I understand home devices that contain all sort of sensors and actuators should be handled in a similar fashion, isn't it? I mean, that PKI doesn't exclude non-approved manufacturers from producing Matter devices, you can always trust their PAA (their…
Matter has a public blockchain with certificates added to enforce which products are considered certified. This is called the distributed compliance ledger (DCL). The hardware devices are expected to ship with certificates on them that match the public ones, and it’s generally not possible to change the on-device certs.
This is distinct from “normal” internet PKI certificate authority where you can just swap out a few files or grab a new cert from Let’s Encrypt. Because this uses a dedicated blockchain with a history of signatures. Depending on how you want to control the device, you’d need to rebuild the whole chain of trust, including eg signatures from Google or Apple.
Also, from a practical perspective, I’m not sure of any actual controllers that let you point to different certificate sources. You can create devices with a “test vendor ID” (0xFFFF) and the controllers are supposed to ignore certs. This has downsides, like OTA updates require signing, you can’t encode proper identifiers in the device so info pages in apps are wrong, etc.
Also, the “border router” isn’t really the point of trust here, it’d be the actual controller device. A border router is just that, an IP router, like a WiFi router or a Ethernet router.